Privacy policy

This policy describes what CanMyPcPlay actually does with data. It describes the current implementation — where a feature is not enabled, we say so rather than reserving rights we are not exercising.

Your PC specifications

PC profiles you create in the checker are stored in your browser's local storage. They are not sent to us and not associated with any identifier. Clearing your browser storage deletes them permanently — we hold no copy.

When you run a compatibility check, the selected component identifiers are sent to our server so the comparison can be calculated. The result is returned and nothing about your configuration is written to our database.

If you create an account and choose to save a PC profile to it, that profile is then stored on our servers against your account, and you can delete it at any time.

Accounts

Accounts are optional — every core feature works without one. If you create one we store your email address, an optional display name, and a hashed password. Passwords are hashed with bcrypt and are never stored or logged in readable form. Sessions use a signed, HTTP-only cookie.

Aggregate usage counters

To power “Trending searches” and “Popular right now”, we keep a running count against normalised search terms and titles. These are counters only. We do not store IP addresses, user agents, session identifiers or user accounts alongside them, so they cannot be traced back to an individual.

Reports you submit

If you use the “Report an issue” form, we store what you submit so an editor can review it. Supplying an email address is optional; if you do, it is used only to reply about that report.

Rate limiting

To prevent abuse, our API endpoints count requests per client for short windows. The derived key is held in memory only, is not written to any database, and expires within minutes.

Cookies and your choices

We set two first-party cookies: a signed session cookie if you sign in, and a cookie recording your consent choice. Your theme preference and PC profiles use local storage, not cookies. See the cookie policy for the full list, including what each one is named and how long it lasts.

On your first visit you are asked which optional categories you allow. Nothing optional is switched on before you answer, and closing or ignoring the banner is not treated as agreement. You can change the decision at any time using Privacy settings in the footer of any page.

Global Privacy Control

If your browser sends a Global Privacy Control signal, we record the optional categories as refused on first visit and do not show you the banner. You can still turn them on afterwards through Privacy settings if you want to.

IP addresses

We do not store IP addresses in our database. They are nonetheless processed in two unavoidable ways, and it would be misleading to claim otherwise. Our hosting provider receives them in order to route requests to us at all. Our rate limiter derives a short-lived in-memory key from the address to stop one client hammering an endpoint; that key lives for minutes and is never written to disk. Any third-party script or image host your browser contacts — currently Google for advertising, and a CDN for application logos — also receives your address directly, because that is how an HTTP request works.

Location

We do not request or store precise device location. We do not use the browser geolocation API anywhere on this site.

Analytics

If you allow the Analytics category, we record usage on our own servers. It is stored as daily totals — a row is (date, event, label) → a number, such as “2026-08-24, compatibility_check, cyberpunk-2077, 41”. There is no row per visitor and no identifier of any kind, pseudonymous or otherwise, so the table cannot answer “what did this person do” — it never held that.

Alongside it we count coarse context once per page view: device category (desktop, mobile, tablet), browser family, operating system family, country, and the host a visit came from. These are kept in a separate table from the events above so the two cannot be combined into something that identifies a browser. We derive them from headers your browser already sends and then discard the underlying values — the full user-agent string and the IP address are read and thrown away, never written down.

What we deliberately do not record: the text of your searches in this table (a separate aggregate counter handles that), page query strings, precise location, or anything that looks like an email address, which is stripped before storage.

If you refuse Analytics, or have not answered, the browser sends nothing and the server discards anything that arrives anyway — the check is made from the consent cookie on our side, not taken on the client's word.

Third-party analytics

Analytics are not currently enabled on this deployment. The integration exists and is controlled by an environment variable; if it is switched on, this section will describe it and the cookie policy will list the cookies involved.

Advertising

Google's AdSense script is loaded on every page of this site, including right now. No advertisements are currently being served through it — the ad slots are switched off while our AdSense account is under review — but the script itself still loads, so we say so rather than describing the site as ad-free. Loading it means Google receives a request from your browser, which necessarily includes your IP address and user agent, as any request to any server does.

Before that script runs, we set Google Consent Mode to denied for advertising storage, advertising personalisation and advertising user data. Unless you turn Advertising on in your cookie settings, it stays denied, and Google should not write advertising cookies or personalise advertising to you. We rely on Google to honour that signal — it is their mechanism, running in their script, and we cannot independently verify their processing.

If you turn Advertising on, Google and its partners may use cookies or similar technologies to serve and measure advertisements, including based on prior visits to this and other sites. You can also review Google's own controls at My Ad Center.

Affiliate links

We currently run no affiliate links. Hardware suggestions come from the publisher's published requirement, not from any commercial arrangement. The database supports affiliate URLs for future use; if any are ever added, they will be disclosed on the pages where they appear.

Data retention

Account details are kept until you delete the account. Issue reports are kept until an editor resolves them and then for a short period afterwards so a decision can be revisited. Aggregate counters hold no personal data and are kept indefinitely because there is nothing in them to expire. Rate-limiting keys expire within minutes. Your consent record lasts twelve months, after which we ask again rather than assuming your answer still holds.

Where a third party controls retention we cannot set it for them. Google decides how long it keeps advertising data; their policies govern that, not ours.

Data sharing

We do not sell personal data. We do not share it with third parties except where a service is required to operate the site — currently our hosting and database providers, plus any analytics or advertising service explicitly enabled above.

Your rights

You can request access to, correction of, or deletion of any personal data we hold about you by contacting us. If you have an account, deleting it removes your profiles and saved items. Note that the aggregate counters described above contain nothing personal and therefore cannot be individually deleted.

Children

This site is not directed at children under 13, and we do not knowingly collect personal data from them.

Changes

If this policy changes materially, the date at the top will be updated. We do not claim certification under any privacy framework, and we do not describe compliance we have not actually implemented.

Contact

Privacy questions can be sent through our contact page.